This simple query function may be used to change the text given, by way of a field from an event or otherwise, to all lower-case letters. This is based on the presumed language, but you can set the language and locale if needed.
|string||false||_lower||The name of the output field.|
|string||true||The name of the input field with the value to convert to lower-case.|
|string||false||The name of the locale to use as ISO 639 language and an ISO 3166 country. When not specified, uses the system locale.|
In addition to providing the field of events to change to all lower-case letters, as well as optionally assigning a name to the resulting field, you can specify the country and language so that conversion is done correctly and without odd characters.
For the value of type, you can specify just the language, or you can
refine that choice by including the country. For instance, you might
en for English. You could be more specific by
en_UK for U.K. English or
en_US for U.S. English. Choosing the right language is
perhaps most important when data includes text in other languages like
Russian with Cyrillic letters.
As a simple example, suppose you have two fields that you want to
concatenate together, but want to set one to all lower-case letters and
the other to all upper-case letters. You might do that using the
concat() function, along with the
functions, like so:
lower(@error_msg, as=msg1) | upper(@error_msg, as=msg2) | concat([msg1, msg2], as=test)
In this query, the
as parameter were used for the
lower() and for the
query functions to label their results. Those field names are then used
concat() function. That wasn't necessary,
though. They could have be referenced by the default names,
_upper. The specific
labeling, though, is particularly useful when you have more than one
field that use the same query function.
The screenshot shown in Figure 1 shows the results of the query above.
One of the events is selected. Notice the text of the message is in lower-case letters, for the first part, and the second message is in upper-case — that part is highlighted in blue in the screenshot.